Method and apparatus for a robust high-speed cryptosystem6154541Abstract A cryptographic information and communication system of the knapsack type characterized by secret logical segregation of the key sets into sections by different construction methods, where different transformations are applied to different sections, and characterized by non-constant number of subset sum solutions to ciphertext, where resolution protocols are employed when necessary to resolve non-unique subset sum solutions at the decryptor. Claims I claim: Description BACKGROUND OF THE INVENTION
______________________________________
1) (V(F(c)) =
1) <=> (F(c) can be verified by V to be the correct
decodes of c), or
2) (V(F(L)) =
1) <=> (F(L) can be verified by V to be the correct
decodes of L)
______________________________________
Let X.sub.c stand for "a cryptanalysis is accumulatively successful at code level", X.sub.L stand for "a cryptanalysis is accumulatively successful at layer level", then accumulatively successful is defined as follows: ##EQU1## (t-bit) Alternate Pad Let C be some known classification of bit patterns of length t, p.sub.1, p.sub.2, . . . p.sub.k be k consecutive bit groups each of length t, and c.sub.1, c.sub.2, . . . , c.sub.n be all the possible classes by C, a t-bit alternate pad (p.sub.1 p.sub.2 . . . p.sub.k) is defined as: 1) (positive t-bit alternate pad) p.sub.1 p.sub.2 . . . p.sub.k such that p.sub.k .epsilon.c.sub.i and p.sub.j .epsilon slash.c.sub.i for some 1.ltoreq.i.ltoreq.n and for all 1.ltoreq.j<k where (the fact that) p.sub.k .epsilon.c.sub.i is known but k is not known, or 2) (negative t-bit alternate pad) p.sub.1 p.sub.2 . . . p.sub.k p.sub.k .epsilon slash.c.sub.m and p.sub.j .epsilon.c.sub.i for all 1.ltoreq.j<k, k>1, and for some 1.ltoreq.i.ltoreq.n and m < >i, where neither k nor p.sub.k .epsilon.c.sub.m is known. Attack-On-Key Cryptanalysis method that tries to decipher the encrypted data through the discovery of keys. For certain cryptographic methods, the keys discovered need not be the very same keys used by the decryptor for decryption. They can be substitutes or alternate keys, which means that decryption keys may not be unique. Attack-On-Code Cryptanalysis method that tries to obtain the original, pre-encryption data by cryptanalizing the codes themselves, one by one. Backward-and-Forward Scrambling A series of two or more scrambling operations on a data stream where the output of one scrambling operation is the input to another scrambling operation. At least one scrambling operation is a backward scrambling operation that reverses the order of its input data stream both before and after performing the scrambling operation, and at least one scrambling operation in the series is a forward scrambling operation that scrambles the data in the same order as they are taken as input. Both the backward scrambling operations and the forward scrambling operations scramble in a chaining fashion, where the scrambling of certain bits is influenced by previous bits in the input stream or by the scrambled version of previous bits in the input stream. Backward-and-Forward Scrambling may also be referred to as Forward-and-Backward Scrambling or Bi-directional Scrambling. Bare Mode (of Communication) In Bare Mode, only data to be securely transferred are protected and encrypted. Also see Shielded Mode. Blurring Set A set of numbers that are added to a key set to introduce unremovable fuzziness. Also see Unremovable Fuzziness. Closure of Scaled Set Let N be the set of natural numbers, y.epsilon.N and y>0, z.epsilon.N and z>0. If for a finite set S={s.sub.1, s.sub.2, . . . , s.sub.m }.OR right.N, the following holds: ##EQU2## where .lambda.=sum((s.sub.1 *z.sub.1)*k.sub.1, (s.sub.2 *z.sub.2)*k.sub.2, . . . , (s.sub.m *z.sub.m)k.sub.m), then S*z is called the scaled set of S or the closure of S scaled by z, and x is an identifiable of {x}.orgate.S. The concept of closure can be generalized. Any operation that turns certain elements of a set into identifiables/tangibles when applied to the other elements of the set can be the `scaling operation` for the closure. Also see Identifiable Element and Tangible Element. Code of Ciphertext One unit of encrypted data bits. Code of ciphertext is also referred to simply as code. The corresponding data bits are called a message unit. Delayed Bit Recovery See Multi-Step Bit Recovery. Decode One solution to a code. In particular for knapsack cryptography, a decode is one decomposition of a number into set members that make up the number exactly. It may not be the solution if the set is not a unique set. When decode is used as a verb, it refers to the operation of obtaining one solution to a code. Decryption Knowingly obtaining all the correct decodes of the encrypted message with the aid of the decryption key and possibly protocols. Designated Element and Section A designated element is an element of a key set whose containment in a subset sum determines how a certain non-zero fuzzy residue is applied to the subset sum. A designated section is a section of a key set in which two or more elements are designated and their collective containment in a subset sum determines how a certain non-zero fuzzy residue is applied to the subset sum. Effective Success Rate Rate of success on cryptanalizing an entire enciphered message (not the rate of success on cryptanalizing an individual code of ciphertext). External Fuzziness Fuzziness (more than one seemingly valid decode) to the cryptanalysis. Also see Fuzzy Residues and Internal Fuzziness. Formal Identification Identification by some formalism or by mechanism constructed based on some formalism. Full Block Dependency The property of a scrambled binary block: it is computationally infeasible to recover any bits from the scrambled block unless the unknown bits in the scrambled block is fewer than some positive integer n. Fuzzy Residues Numbers that when added to the subset sum of some U set can result in more than one decode. Fuzzy residue is applied, for example, by the addition of a certain multiple of an element from a set of fuzzy residues to a subset sum, in accordance with a defined mapping and determined by the number of a key element contributed to the subset sum. Also see Internal Fuzziness and External Fuzziness. Hash Hash is some kind of scrambling (function) that may not be invertible. A hash is expanding if its input size is smaller than its output size. Such a hash is also referred to as expand hash. A hash is compressing if its input size is greater than its output size. Such a hash is also referred to as compress hash. For practical purposes and without loss of generality, a hash function h is talked about in the context of a finite domain. A hash h is collision free if for any given input x (in the domain of h), the following holds: ##EQU3## A hash h is collision sparse if for any given input x (in the domain of h), .pi. is quite small relative to .delta., where .delta. is the size of the domain of h and .delta. is the size of the largest subset S of the domain of h satisfying the following: h(x)=h(s) where x< >s and s.epsilon.S A hash h is collision ridden, if .pi. is quite large relative to .delta.. A hash h is one-way, if for any given h(x), it is computationally infeasible to derive x from h(x). A hash h is one-way-sparse, if for any given h(x), it is computationally infeasible to find some y in the domain of h such that h(x)=h(y). Higher-Layer See Multi-Layer Scheme Identifiable Element An element of a set (or its multiple) that can be uniquely, deterministically, unambiguously and efficiently identified from any subset sum it contributed to. It is also referred to as an identifiable. Informal Identification Identification by human and not by mechanism constructed based on formalism. Internal Fuzziness Fuzziness (more than one seemingly valid decode) to the decryptor (decryption by keys). Also see Fuzzy Residues and External Fuzziness. Inverse Iteration Inverse Iteration is an iteration. Inverse iteration is an operation on a set B={b.sub.1, b.sub.2, . . . , b.sub.n } of numbers defined to be: (B*w.sup.-1).XI.m={b.sub.1 *w.sup.-1 .XI.m, . . . , b.sub.2 *w.sup.-1 .XI.m, . . . , b.sub.n *w.sup.-1 m} where B is (equals) an iterated set from some set A by some w and m, and w.sup.-1 is the multiplicative inverse of w modulo m. To inverse iterate is to perform such a inverse-iteration on a set. Also see Iteration. Iteration An operation on a set A={a.sub.1, a.sub.2, . . . , a.sub.n } of numbers defined to be: (A*w).XI.m={a.sub.1 *w.XI.m, a.sub.2 *w.XI.m, . . . , a.sub.n *w.XI.m} for some w and m, where (w, m)=1. To iterate is to perform such an iteration on a set. Also see Inverse Iteration. Layer See Multi-Layer Scheme. Layered-Scheme See Multi-Layer Scheme. Lower-Layer See Mtulti-Layer Scheme. m-Identifiable (m-Tangible) Set A set containing m identifiables (tangibles). m-Identifiable (m-Tangible) Set is also referred to as Partially Identifiable (Tangible) Set if the set size is greater than m. Multi-Layer Public-Key Cryptosystem A cryptosystem that adopts multi-layer scheme of some cryptographic methods. Multi-Layer Scheme A method where encryption keys are also encrypted. The method in which the encryption key is used directly to encrypt data is a single-layer scheme. Each encryption of an encryption key is an added layer. A lower layer is an encrypted binary block in which there is an encryption key. A higher layer is a binary block in which there is an encryption key that encrypts a lower layer or data. Multi-Step Bit Recovery In decryption, certain bits x are recovered in more than one step. Each step, which recovers other bits in the meanwhile, gains some partial information that will assist the final recovery of x in a later step. Near-Unique Set A set that, except for a limited few elements, is a unique set. Non-Unique Set A set that is not a U Set. In other words, there exist subsets A and B of the non-unique set such that sum(A)=sum(B) but A < >B. Also see Unique Set (U Set), and Near-Unique Set. One-way Characteristics Function A computationally infeasible-to-invert function that returns some characteristics of the input to it. In other words, it is computationally infeasible to deduce the input or part of the input from the output of the One-way Characteristics Function. Operational Password Length The minimum length of passwords that a cryptosystem will accept. Partial Exposure Undesired exposure and revelation of part of a message from its corresponding ciphertext by cryptanalysis. Partially Identifiable (Tangible) Set See m-Identifiable (m-Tangible) Set. Private-Key Encryption Encryption performed by the keys of either a asymmetric or symmetric method with keys kept secret. Private-key encryption is also known as secret key encryption. In the prior art, private key encryption may only refer to encryption by symmetric keys. Ranged Number A number that falls within a (specified) range. Reflexive Dependency (of Message Units) In the decryption of a code, the recovery of certain bits of the message unit depends on the correct recovery of certain other bits of the same message unit. Such kind of dependency is Reflexive Dependency of Message Units or simply Reflexive Dependency. Removable Fuzziness Fuzziness (resulted from fuzzy residues), internal or external, that can be removed. In other words, of all the decodes of a code, only one of the decodes is valid and can be verified to be valid with no more information than what is available and contained in the code(s). Residue The notion of residue is used in two ways: 1) residue class as used in G. Orton's residue knapsack. 2) `noise` as used in some places in this invention and the d parameter used in Chor-Rivest knapsack. Rugged Compact Set A rugged compact set is a compact set where not all subset sums are valid and defined. Scrambling vs Encryption For the purpose of this invention, a distinction is made between scrambling and encryption. Scrambling is transformation of data from some easily recognizable format to another that is not. But scrambling does not guarantee that the scrambled data can not be easily transformed back to their original format or to another easily recognizable format if the scrambling method is known. Encryption is transformation of data from an easily recognizable format to one that is neither easily recognizable nor feasibly transformable, through a certain implementable algorithm, to an easily recognizable format, even if the cryptographic method is public knowledge. Secret Key Encryption See Private-Key Encryption. Sectioned Key Set A sectioned key set is the union of sets that may be generated with different methods and/or with different generation controlling parameters. Each of these sets is a section. Semantics Dense See Semantics Sparse. Semantics Sparse Semantics sparse is loosely defined as: given any arbitrary (finite) sequence of syntactical units, the probability that it is meaningful is low. A high probability (of such a sequence being meaningful) is referred to as Semantics Dense. For ASCII representation of the English alphabet, a syntactical unit is a byte. A (finite) sequence of bytes may or may not form English words or the formed English words may not satisfy the English grammar. A sequence of bytes may not be meaningful even it is syntactically and grammatically correct. For a black-and-white bitmap picture, the syntactical unit is a bit (a one-bit for a black pixel and a zero-bit for a white one). Therefore, English text is semantics sparse while bitmaps are semantics dense. As a side note, scrambled/encrypted data are normally semantics dense. Also see Syntax Sparse and Syntax Dense. Session Identifier (Id) A bit sequence communicated during a session and known to all communicating parties but secret to others. Shielded Mode (of Communication) In Shielded Mode, much or all of what is communicated that can be encrypted is before being transmitted. Shielded Mode in this invention particularly refers to using session or message specific encryption/decryption keys of a public-key scheme as the shield keys. Also see Bare Mode. Single-Layer Public-Key Cryptosystem A public-key cryptosystem that does not encrypt data encryption keys. A cryptosystem may be able to perform both as a single-layer public-key cryptosystem (when in single-layer public-key mode) and as a multi-layer public-key cryptosystem. Symmetric Key Encryption/Decryption Encryption/decryption using symmetric keys/methods. Syntax Dense See Syntax Sparse. Syntax Sparse Syntax sparse is loosely defined as: given an arbitrary bit sequence of the size of a syntactical unit, the probability that the bit sequence is a valid syntactical unit is low. A high probability (of the sequence being a valid syntactical unit) is referred to as Syntax Dense. For English Alphabet represented in ASCII, the probability is lower than 0.21 but for a bitmap the probability is 1. As a side note, scrambled/encrypted data are normally syntax dense. As a matter of fact considering avalanche effect, the size of syntactical units may not stay the same after scrambling and may be drastically increased. Also see Semantics Sparse and Semantics Dense. Tangible Element A set element whose presence or absence in any subset sum can be deterministically and efficiently decided. It is also referred to as a tangible. Time Sensitive Transmission Block A Time Sensitive Transmission Block is a logical block of data sent from one party to another where the receipt of the complete logical block of data must be within a time frame. An example of a Time Sensitive Transmission Block is a challenge packet transmitted during an identification protocol where the complete challenge packet is expected to be received before a timeout t expires. Trivial Set (Bag, Vector) For the purpose of this invention, a trivial set (bag) is one that is either empty or has only zeros as its entries, and a trivial vector is one that either has zero dimension or has only zero value weights. Unique Set (U Set) A set X is a unique set (or U Set) if for any arbitrary sets Y.OR right.X and Z.OR right.X the following holds: ##EQU4## Also see Near-Unique Set and Non-Unique Set. Unremovable Fuzziness Fuzziness (resulted from fuzzy residues), internal or external, that can not be removed without additional information of some characteristics of the message (pre-encryption data). Wrinkling Set A set of numbers that are added to another set (of numbers) of the same size to disturb some special structure, regularity or inter-dependency of the elements of that other set. The term to wrinkle also refers to the adding of a wrinkling set to another set. DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS This invention, in its simplest configuration, consists of at least one encryption device or at least one decryption device, and is capable of performing encryption or decryption. In a general configuration, the present invention will include: 1) at least two crypt units, both coupled to some media referred to as Data Transit Media (DTM), each consisting of an Encryptor E and a Decryptor D 2) a set of Input/Output peripherals (I/O) including secure Data Storage (DS) for each crypt unit 3) a Key Generator (KG) for each crypt unit 4) a Communications Protocol unit (CP) for each crypt unit I/O of the crypt unit consists of devices and peripherals for input and output, as well as secure data storage DS, such as transient memory and hard disks. KG generates keys based on random or semi-random input. Users can supply passwords which are mapped to the keys generated. Other examples of random input can be: compiled past period hard disk access statistics, user keyboard latency, inputs from sensing devices monitoring random environments, etc. In this invention, the term random will also be used for pseudo-random. In places where true randomness is achievable, this invention recommends the use of it. Pseudo (or semi) randomness is the output from some generator driven by some truly random input. E performs encryption and D, decryption. CP provides the interface of the crypt unit to the communications media and handles protocols of the communications between its crypt unit and other crypt units that have access to the same communications media and involve in the communication. Referring now to the drawings, and more particularly to FIG. 1, there is shown the invention in summary form. Input into Crypt Unit A (A) can be a password or data to be encrypted, or the data to be encrypted can be in media and storage inside A. When, for a simple example where an earlier key establishment was achieved, A is given the instruction to perform encryption and to send the encrypted data to B, A inputs the data into E 11A, has the data encrypted in E 11 and transmits the ciphertext to B via DTM 10. B receives the ciphertext from A and decrypts the ciphertext by D 12B. Recovered data will be output by B. The same operations can also be performed in the other direction, i.e. B encrypts and A decrypts. FIG. 2 shows a detailed view of the invention in one directional encryption/decryption mode. The large dotted box on the left is the one performing encryption (encryption configuration of Crypt Unit A) and the one on the right is the one performing decryption (decryption configuration of Crypt Unit B). A initiates, via A's CP 27A, a connection to B requesting a secure transfer from A to B. B grants the connection. KG 26B of B generates a set of keys, stores the private key for decryption and sends the public key via CP 27B to A. A on obtaining the public encryption key, retrieves data from DS 25A to be encrypted in E 22A. The final ciphertext is passed from E 22A to CP 27A and then sent into DTM 21. B on receiving the encrypted data via CP 27B decrypts the ciphertext. The recovered data are either stored in DS 25B or output to other devices I/O 24B. During the session of encryption-decryption, a protocol may be invoked. For example, A may asynchronously tell B that a new fuzzy residue mapping is to be established. Then they both switch to a mode that facilitates the establishment. On completing the establishment, they both fall back into normal encryption-decryption mode, and continue to perform encryption/decryption, using for example the newly established residue mapping. During the session, A and B may also fall into resolution mode to resolve or partially resolve fuzziness in decryption. When the resolution or partial resolution is complete, they again fall back into encryption-decryption mode and continue to perform encryption and decryption. FIG. 3 shows a simple apparatus in which two large registers (possibly large enough to hold the largest number to be manipulated) and some logical circuitry (Operator 32) capable of performing the necessary operations, such as addition, multiplication, etc. Selector 31 is some circuitry that fetches the appropriate values from Memory/Registers 30, a bank of memory or registers, and loads the appropriate register (Register I 33 or Register II 34). After the operation on the values of both registers, the result is loaded back into Register II 34. Then Selector 31 can select the appropriate register or memory location in Memory/Registers 30 to store the result to. In brief, the present invention uses numbers generated by KG to construct the decryption key, the encryption key and an invertible cryptographic transformation T. The encryption key consists of the encryption key set K.sub.e, and possibly a set F of fuzzy residues for encryption. The decryption key is made up of the decryption key set K.sub.d, a set G of fuzzy residues corresponding to F for decryption. Referring now to FIG. 4, which shows the encryptor logic, data bits are grouped and loaded into Data Register 41. At the same time, Code Register 42 is reset to 0. Shifter 43 is controlled by the parameter h so that each time, h bits are shifted and fed to Multiplier I 45. Selector I 44 will select the appropriate key element from Encryption Key Set 402 to form a product by multiplying it with the value of the habit group in Multiplier I 45, which in turn feeds the product to Adder 46. Meanwhile, the value in Code Register 42 also comes to Adder 46. This way the contents of Code Register 42 are accumulated with the product from Multiplier I 45. At the same time Shifter 43 shifts out the h bits to Multiplier I 45, it also shifts them out to Mapper 47 which maps the value of the h-bit group to an appropriate corresponding multiple. The multiple and the fuzzy residue selected from Fuzzy Residue Set 401 by Selector 49 form a product which in turn is fed into Adder 46 to be applied to the accumulating sum. When all bits have been shifted out from Data Register 41 and Code Register 42 contains the final sum, the result is output as one code of the ciphertext. Selector II 49 is synchronized with Selector I 44 so that the appropriate fuzzy residue from Fuzzy Residue Set 401 is selected by Selector I 49 if Selector I 44 selects a designated element from Encryption Key 402. If the element of the encryption key is not a designated element, Selector II 49 inputs zero into Multiplier II 48 , effectively supplying zero to Adder 46 so that it is equivalent to no fuzzy residue being applied. Encryption is done by taking the encryption key vector K.sub.e and the vector of numbers formed by the grouped data bits to produce the inner product C, the code of the ciphertext. C is just a subset sum of K.sub.e and the elements of K.sub.e corresponding to the non-zero-bit groups will contribute to the subset sum. Fuzzy residues, which do not affect the unique recovery of the original data, may be added to the ciphertext C based on the specifications for the fuzzy residues. As there is an effective and efficient algorithm to single out the numbers that made up the subset sum of the decryption key set, when the ciphertext is inversely transformed to the corresponding subset sum of the decryption key set by T.sup.-1, the corresponding multiples of members of K.sub.d can be identified, and thus the corresponding non-zero-bit groups, and naturally and trivially the rest zero-bit groups, of the original data can be recovered. Refer now to FIG. 5, the decryption logic. First the wrinkling set is constructed and loaded into Wrinkling Set 51. Ciphertext is loaded into Code Register 52 one code at a time and each time the registers/memory-cells of Bit Groups & Quotients 53 are reset to 0. Selector I 54 selects the appropriate modulus/multiplicative-inverse pair(s) from Moduli 560 and Multiplicative Inverses 570 respectively and Iterator 550 inverse iterates the code from Code Register 52 using the selected modulus/multiplicative-inverse pair(s). Then Selector II 55 and Selector III 56 are activated to select the appropriate decryption key element from Decryption Key Set 57 and appropriate fuzzy residues from Fuzzy Residue Set 58 to feed into Extractor 59. Extractor 59 extracts the data bits, or a quotient if delayed recovery is needed, and stores them in Bit Groups & Quotients 53. It also sends the partially processed code back to Code Register 52. The process is repeated till all bit groups and their quotients are extracted. Finally, the appropriate quotients selected by Selector V 510 and the corresponding elements in Wrinkling Set 51 by Selector IV 520 are fed into Delayed Bit Recovery 530 to reclaim the rest of the bits that are delayed in recovery. The bits then go through Permuter 540 to be permuted to their right positions before being output as the recovered original data bits. This invention embraces two configurations for the cryptosystem. The basic configuration, which is referred to as Purely Public Key Scheme (PPKS), does not further protect the actual encryption key and the encryption key may be published. The extended configuration, which is referred to as Quasi Public Key Scheme (QPKS), does not publish or reveal the encryption key as is. Instead, the encryption key as well as other relevant data or cryptographic information are mixed with redundancy or `garbage` elements that hide the actual key elements. Data may also be so extended using QPKS. PPKS is specified as follows: Let S={C, h, I, k, n, P, R, R} be the general definition of the cryptosystem with the following properties: 1) n is the size of the public and private key sets, or the dimensions of the private and public key vectors. 2) k (l.ltoreq.k.ltoreq.n) is the number of sections for the sectioned key set. 3) P is a permuter (of n numbers), with P.sup.-1 as the inverse permuter such that for any (finite) sequence X: P(P.sup.-1 (X))=P.sup.-1 (P(X))=X where P and P.sup.-1 can be driven by random input or the password. 4) R is a random number sequence generator that produces a sequence of numbers in response to some input seed (number). 5) I={i.sub.1, i.sub.2, . . . } specifies the points, i.sub.1, i.sub.2, etc., in the system, where the random number generator R is to be re-initialized with a new seed for multi-seeding. The re-initialization points can be driven by the password. 6) R={r.sub.1, r.sub.2, . . . } is a set of couples of numbers used to generate ranged numbers. The couples are the inclusive lower and upper bounds of the ranges. 7) C={c.sub.1, c.sub.2, . . . , c.sub.k } is a set of k numbers used to control the wrinkling effect. 8) h>0 is a natural number that specifies the number of data bits to be grouped to form vector elements for encryption. The following parameters may also be generated by or specified to the cryptosystem: 1) Z={z.sub.1, z.sub.2, . . . , z.sub.k } is a set of k non-zero natural numbers where sum(Z)=n. The z.sub.i, for 1.ltoreq.i.ltoreq.k, is the size of the ith sectioned key set. 2) G={g.sub.1.1, g.sub.1.2, . . . , g.sub.i.1, g.sub.i.2, . . . } is a set of decryption fuzzy residues. 3) F={f.sub.1.1, f.sub.1.2, . . . , f.sub.i.1, f.sub.i.2, . . . } is a set of encryption fuzzy residues. 4) For each section the following are specified or generated: 4.1) t.sub.i specifies the total number of iterations that will be performed on the (partially if i<k) constructed key set and the fuzzy residue set. 4.2) M.sub.i ={m.sub.i.1, M.sub.i.2, . . . }, W.sub.i ={W.sub.i.1, W.sub.i.2, . . . } and W.sub.1.sup.-1 ={W.sub.i.1.sup.-1, W.sub.i.2.sup.-1, . . . } are each a set of t.sub.i numbers, where each m.sub.i,j -w.sub.i,j pair is used to perform an iteration, M.sub.i,j is so selected that inverse iterations will not introduce ambiguity. For example, m.sub.i,j is larger than 2.sup.h -1 times the sum of all the numbers in the set(s) to be iterated, (m.sub.i,j, w.sub.i,j)=1 and w.sup.-1.sub.i,j is the multiplicative inverse of W.sub.i,j modulo m.sub.i,j, for 1.ltoreq.j.ltoreq.t.sub.i. The m.sub.i,j -w.sub.i,j.sup.-1 pair is used to perform inverse iteration. In the case where G is to be iterated also, m.sub.i,j will be selected with G in the consideration. For example, m.sub.i,j is larger than the sum of the maximum multiples of all so far generated and iterated key set and residue set elements. If c.sub.i >0, the following, pertaining to section i, may also be generated: 4.3) q.sub.i, the number of elements of the ith section (sectioned key set) to be wrinkled where q.sub.i .ltoreq.z.sub.i. I.e. the number of non-zero elements of the wrinkling set. 4.4) B.sub.i ={b.sub.i.1, b.sub.i.2, . . . } is the wrinkling set (of ranged numbers) of size z.sub.i corresponding to the ith key section. The wrinkling set is to disturb the regularity of the set it is applied to. 5) FM() is an invertible fuzzy residue mapping function for both encryption and decryption. Through the transformations, the decryption fuzzy residue set is transformed to the encryption fuzzy residue set, but the encryption key inherits the fuzzy residue mapping by retaining the same mapping defined and specified for the decryption key so that the association between any encryption key element and its mapped encryption fuzzy residue element is the same as the association between the corresponding decryption element and its mapped decryption fuzzy residue element. Except possibly M, W, W.sup.-1 and F, a parameter can be any of the following: 1) be specified for the system and stay constant 2) be specified at will whenever desired, as variables controlling both the system and the keys generated 3) be generated by the system driven by random input 4) be given ranges so that the system generates values for the parameters that fall within the specified ranges. It should be obvious to anyone skilled in the art that the system can be vulnerable if all other parameters, except M, W, W.sup.-1 and F, are constant. A simplified way of generating the public encryption key and the private decryption key is described in the following example process:
______________________________________
1) Let A and X start as empty sets.
2) generate B.sub.1 through B.sub.k, the wrinkling sets
3) for (i=1; i.ltoreq.k, i++)
{
4) generate A.sub.i ={a.sub.i.1, a.sub.i.2, ..., a.sub.i.u }, a
key section
5) add b.sub.i.j *c.sub.i to a.sub.i.j (wrinkle section A.sub.i)
/* if c.sub.i =0, A.sub.i is not changed */
6) X.sub.i < A.sub.i
7) B.sub.i < 0
8) A < (A .orgate. A.sub.i)
9) X < (X .orgate. X.sub.i)
10) iterate X t.sub.i times
11) iterate B t.sub.i times
}
12) Let K.sub.e be the permuted X by P
______________________________________
In step 4), u=z.sub.i. In step 6) after the assignment, elements of A.sub.i can be effectively and efficiently identified and singled out from any subset sum of members of the so-far-con-structed X. Fuzzy residues can be generated during the above described process. K.sub.e is the public encryption key set, and a subset of F, if applicable, is also part of the public key. A.sub.l through A.sub.k (or A) and all the parameters for the reverse transformation are the private key, where A is the private key set. Data to be encrypted are represented in binary form and grouped into n numbers, each formed by h bits. So each n*h-bit group can be turned into one code of the ciphertext. Encryption is done by forming the inner product of the encryption key vector and the n numbers taken as a vector, producing a subset sum of the encryption key set with the numbers in the encryption key set corresponding to the non-zero h-bit groups contributing to the subset sum, and some fuzzy residues may be added in the process of forming the subset sum. Decryption is to perform the inverse transformation on the ciphertext to recover the original data bits. As the code goes through the inverse transformation, the elements of A.sub.k down to A.sub.1 corresponding to those of K.sub.e contained in the subset sum can be identified, as well as any contained fuzzy residues. Once the elements of the private key and any fuzzy residues are identified, they are subtracted from the being decrypted code of the ciphertext, and the corresponding non-zero-bit groups are remembered. Finally, all non-zero-bit groups, and naturally and trivially the rest zero-bit groups, can be recovered. After discarding unwanted residue(s), if any, and applying the inverse permutation P.sup.-1, the original data bits are obtained. This invention employs various construction methods and different values for system parameters, giving the generated public key, and as a result the cryptosystem itself, different characteristics. According to one feature of this invention, the key can be designed to accommodate residue or noise in subset sums. In particular, when the decryption key set is superincreasing for example, noise of up to x-1 may be tolerated if a.sub.1,1, equals some natural number y and a.sub.1,2 equals some natural number x+y. That is, numbers whose sum is at most x-1 can be iterated by the same parameters as those used in the private-key-to-public-key transformation and can be added to any subset sum of the public key set without affecting unambiguous decryption. This is the Residue Public Key Method (RPK or RPKM). In general, residue or noise can be numbers that when added to a subset sum do not affect the unique solution of the subset sum. Therefore, identifiables can be used as residues. According to another feature of this invention, when one or more c.sub.i 's are greater than 0, certain otherwise inherited regularity of the public key set, can be disturbed. For example, with c.sub.i greater than 0, the property of a superincreasing A.sub.i can be disturbed. In particular, if in applying the disturbances the resulting key set remains a unique set of identifiables, the application is the Wrinkled Public Key Method (WPK or WPKM). According to still another feature of this invention, when k is greater than 1, the public key set is in essence generated in sections that may be generated by different construction methods and may go through a different series of modular multiplications and transformations. This is the Sectioned Public Key Method (SPK or SPKM). According to yet another feature of this invention, residues can be so designed and applied that unique decoding and in particular single solution decoding is not guaranteed for attack-on-code cryptanalysis. This is the Fuzzy Public Key Method (FPK or FPKM). Fuzziness can be built into the encryption key set where, as in WPKM, each key set element is added by an integer--the application of a blurring set--resulting in a non-unique key set. Fuzziness can also be introduced by a separate fuzzy residue set where both the fuzziness (or the `amount of residue`) and the way fuzziness is applied is related to the data being encrypted. In particular, the generalization of RPKM in conjunction with WPKM is of interest. Assume that the union of so far generated and iterated u sections contain a.sub.1, . . . , a.sub.2, . . . , a.sub.m and section u+2 is of size t. Next identifiables a.sub.m+1, . . . , a.sub.m+5, are generated and a.sub.m+1 through a.sub.m+1 through a.sub.m+s-t+1 are the elements of section u+1, where s>t.>1 Then a.sub.1 through a.sub.m+s may be iterated to b.sub.1 through b.sub.m+s respectively before generating the first superincreasing identifiable x of section u+2. The rest of the elements of section u+2 are: x+b.sub.m+s-t+2, x+b.sub.m+s-t+3, . . . , x+b.sub.m+s. QPKS is specified as follows: Let S={C, h, I, k, n, P, R, R} be the general definition of the cryptographic system with the following properties: 1 ) n is the size of the extended sets. 2) I={i.sub.1, i.sub.2, . . . , } specifies the points, i.sub.1, i.sub.2, etc., in the system, where the random number generator R is to be re-initialized with a new seed. The re-initialization points can be driven by the password. 3) k is the message unit size that controls how the to-be-extended binary block is broken down in to smaller pieces, each as a single element in an extended set. 4) P is a permuter (of n numbers), with P.sup.-1 as the inverse permuter such that for any (finite) sequence X: P(P.sup.-1 (X))=P.sup.-1 (P(X))=X where P and P.sup.-1 can be driven by random input or the password. 5) R is a random number generator that produces a sequence of numbers in response to some input seed (number). 6) R={r.sub.1, r.sub.2, . . . } is a set of couples of numbers used to generate ranged numbers. The couple are the inclusive lower and upper bounds of the range. 7) C is a set of (enumerations of) classification methods used for the construction of partially tangible (extended) sets, and a (random) selection of any one of them can be applied for the extension of sets for an instance of encryption. 8) h>0 is a natural number that specifies the number of data bits to be grouped to form vector elements for encryption. In general, the extended sets can be of different sizes. The binary bit block to be extended will be first broken into pieces. It can be broken down in a couple of ways: of exactly k bits, of at most k bits, or of about k bits a piece. However, if all the pieces are of exactly k bits, it may not be secure. If the pieces are of variant sizes, a redundant one-bit will be added to the front of the pieces to `shield` the leading zero-bits. Such pieces are referred to as message units. Then an m-tangible set of n numbers (where n.gtoreq.m) for each message unit is generated such that, when they are transformed, one of the tangibles is transformed to the message unit. The set may then be permuted. If the tangible has its entry in the extended key vector randomly selected, no permutation is needed. The receiver of the extended sets will form a different subset sum for each extended set to send to the sender/constructor of the extended sets. A positive notification (confirming the containment of the message unit in the subset sum) from the sender of the extended sets indicates those not used in forming the subset sum are all non-message units. Otherwise, a negative notification indicates that those used to form the subset sum are all non-message units. Therefore, the elements that are not message units of the extended set will be identified in groups and when finally all non-message units are identified, the message unit is naturally and trivially identified. After all the pieces of the original bit block are identified and concatenated, with the redundant leading one-bits removed, the original block is recovered. When QPKS extends a key alone, it is the Constant Lower Layer Method (CLL or CLLM), so called because the cryptographic method of the encrypted key is made known and the receiver of the extended key sets needs to know, after obtaining the key, of what cryptographic method the key is, so it can use the key to perform encryption. Obviously, the receiver can be confused if it can receive more than one type of indistinguishable cryptographic keys. Another method, Variant Lower Layer Method (VLL or VLLM), can include all necessary information about what QPKS extends, plus possibly other useful information that needs be protected. An example of the realization of VLLM can take the following format for the block to be extended: <alternate pad><type><start><stop><random insert><key><trailing pad> where: <alternate pad> is to make the position of <type> random if <alternate pad> is generated randomly. <type> is the enumeration of the types of cryptographic methods (keys) the cryptosystem will use in the lower layer(s). E.g. 1 can represent DES, 2 can represent data, 3 can represent PPKS with n=16 and h=8, and 4 can represent PPKS with n=16 and h=16, etc. <start> is the position of the first bit of <key> in the block, counting from the first bit of <type>. <stop> is the position of the last bit of <key> in the block counting from the first bit of <type>. If the size of <key> can be calculated or derived, <stop> can just contain random bits. <random insert> is a group of random bits inserted in front of <key> to make the starting position of <key> random. The size of <random insert> in bits is the value of <start> minus the size (in bits) of <type>, <technique>, <start> and <stop>, which are all constant in size, and the value of <start> is the size in bits of <type>, <technique>, <start>, <stop> plus a ranged random number, which is the number of random bit insert before <key>. <key> is the key of a certain cryptographic method, or possibly data, to be extended. Although syntax sparse or semantics sparse data are not secure using QPKS directly, yet such data can always be processed first by some simple, fast scrambling operations, such as Backward-and-Forward Scrambling, to make them dense in syntax and semantics. <trailing pad> is optional random bits to hide the true end of <key>. In QPKS, the subset sums are generated in basically the same way as in PPKS by the receiver of the extended sets, i.e. taking the inner product of the extended vector and the vector formed by the bit groups of data. The difference is that, for QPKS, the bit groups are not `pre-determined` data. Random bit groups will better serve the same purpose. However, in QPKS, different elements from the extended set will be chosen to form the subset sums. The decryption process of QPKS is essentially the same as that of PPKS except that QPKS may not need to identify all elements that contributed to the subset sum. It may only need to determine if the tangible of interest is contained in the subset sum. The point of interest for QPKS is how a block of (to-be-encrypted) bits is broken down into pieces and how a tangible in an m-tangible set is transformed to it. For VLLM, the block will have some specific format as the example format of VLLM given in this invention and can be applied BFSM first. For simplicity, it is assumed for the following example that the block is just : ENGLISH.quadrature.OR.quadrature.GREEK where .quadrature. stands for a blank space. The ASCII binary representation is:
______________________________________
0100 0101 0100 1110 0100 0111 0100 1100
0100 1001 0101 0011 0100 1000 0010 0000
0100 1111 0101 0010 0010 0000 0100 0111
0101 0010 0100 0101 0100 0101 0100 1011
______________________________________
The bits are given four in a cluster for easy reading. It is further assumed that the bits are to be grouped in size of about k=32, and a random sequence is generated for this purpose: 30, 31, 34, 33, 32, . . . , then the grouped bits will be:
______________________________________
0100 0101 0100 1110 0100 0111 0100 11
(30 bits)
00 0100 1001 0101 0011 0100 1000 0010 0
(31 bits)
000 0100 1111 0101 0010 0010 0000 0100 011
(34 bits)
1 0101 0010 0100 0101 0100 0101 0100 1011
(33 bits)
______________________________________
As there can be leading zeros for grouped bits (all but the fourth bit group of the above example), they need to be protected from being lost in the identification process where they are turned into numbers with leading zeros ignored. For this purpose, a one-bit is added to the front of all the groups as the most significant bit so that the bit groups will then be:
______________________________________
10100 0101 0100 1110 0100 0111 0100 11
100 0100 1001 0101 0011 0100 1000 0010 0
1000 0100 1111 0101 0010 0010 0000 0100 011
11 0101 0010 0100 0101 0100 0101 0100 1011
______________________________________
When the bit groups are identified, the leading one bit of each group is stripped to get the original bits. The extending of the first piece of the block, 10100 0101 0100 1110 0100 0111 0100 11, which will be referred to as d for the convenience of explanation, is demonstrated next. It is assumed that h=2 and an extended 1-tangible set is generated: E={e.sub.1, e.sub.2, . . . , e.sub.n } The set can be unique, near-unique or with fuzziness applied by using a fuzzy residue set and fuzzy residue mapping while maintaining the tangibility of the tangible to be transformed to d. For this simple example, it is assumed that no fuzzy residue is applied. It is further assumed that e.sub.2 happens to be relatively prime to 5 and, applying the concept of closure of scaled set, each of the rest of the elements in E that is relatively prime to 5 is multiplied by 5. Then the extended set is iterated twice to produce G={g.sub.1, g.sub.2 , . . . , g.sub.n }. It can be determined whether g.sub.2 is contained in a subset sum x of G after the subset sum is inverse iterated to the corresponding subset sum y of E. This is because if g.sub.2 is used to construct x, then e.sub.2 is contained in the corresponding y which is inverse iterated from x. In that case, when y is divided by 5, there will be some non-zero remainder. If g.sub.2 is not used in constructing x, y will divide 5. If G is iterated once more and g.sub.2 is transformed to d, then the iterated version of G is a set whose subset sums containing d are able to be inversely transformed back to the corresponding subset sums of E containing e.sub.2, the tangible. First a number m>sum(G)*(2.sup.h -1), m>d and (m, g.sub.2)=1 is chosen. Then g.sup.-1.sub.2, the inverse of g.sub.2 modulo m is calculated. Finally, w=(g.sup.-1.sub.2 *d).XI.m is obtained. As (g.sub.2 *w).XI.m =(g.sub.2 *g.sup.-1.sub.2 *d).XI.m=(1*d).XI.m=d, the iteration by m-w will transform g.sub.2 to d. To guarantee that the multiplicative inverse w.sup.-1 exists (so that the inverse transformation does not create non-unique decoding), it is necessary that m and d be also relatively prime. It should be obvious to anyone skilled in the art that the magnitude of d is related to that of m, and a too small d in the midst of large elements of the iterated G, for example, exposes d. QPKS differs from prior art public-key cryptosystems/schemes in a special way: no data or encryption keys embedded in the extended sets are readily available to cryptanalyses or attacks. Until the commencement of the protocol for the receiver of the QPKS extended key sets to identify the key/data elements, the extended key sets themselves offers little for cryptanalyses to exploit, given that the block extended is syntax and semantics dense. Methods to be introduced next are to provide improved security, higher information rate, and more robustness of this invention. Key generation of this invention may in part rely on numbers or sequences of numbers generated by a random number generator. It is essential that the sequences generated and used in the construction of private and public keys be not revealed even though the characteristics of the generator is publicly known. A sequence generated by a random number generator will be determined by the initial stage of the generator, which is usually set by a seed or number fed to it. Without the knowledge of the seed, it is difficult to learn what sequence of numbers can be generated. However, the sequence can be exposed if the number of seeds the generator can take as unique is small and/or the sequence generated by the initialization of a single seed is long enough. This is because if the possible unique seeds are not many, all possible seeds can be tried to see which seed results in the sequence or in the keys constructed from the sequence. If the sequence generated with one particular seed is long, the sequence itself might expose some characteristics of the sequence, helping the cryptanalyst to deduce the seed. KG and some other mechanisms of this invention employs the following efficient methods to defeat the feasibility of the attempt at the keys via a breakthrough from the random number generator: 1. Segmented sequences 2. Reassembling of fragmented/fractured numbers 3. Multi-seeding 4. Re-seeding 5. Combinations of any of the above 4. Segmented sequences are sequences formed by sections from a sequence or sequences. For example, the 3rd through the 7th and the 101st through the 110th numbers from one sequence may be joined with the 999th number from another sequence to form a new, segmented sequence. Reassembling of fragmented/fractured numbers is the method of taking `digits` from one or more numbers, with or without some manipulations on them, to form a new number. For example, given a decimal number 9837523642, the last digit, then the 5th, then the sum of the first and the last can be taken to form a new number 2511. Multi-seeding is the notion of selecting many initial stages (seeds) for the random number generator to generate more than one sequence and to join sections of the sequences to form a new sequence, while keeping the length of the sections secret. In other words, it may be randomly decided when to stop taking numbers from one sequence and to start with another sequence. The seeds can be random input from the user or other sources. It should be trivial and obvious to one skilled in the art that segmentation, fragmentation and multi-seeding can be directly associated with passwords rather than an invariant part of the cryptosystem or the random number generator. Re-seeding is to scramble certain seeds or the output driven by the seeds and to used the scrambled output as new seeds. In particular, seeds can drive expand hash functions using multi-seeding, then (sections of) the expanded output can be scrambled and compress hashed to produce new seeds. In an alternate embodiment for password-to-key mapping, a system default, i.e. a default bit sequence of length zero or more, can be used to blend with the user password in a defined way and the seeds are the result of a scrambling function with uniformly distributed output. The seeds are then used as input to an expand hash function and a pseudo-random sequence can be generated with appropriate ranges applied. The pseudo-random numbers can be used as parameters in various ways to drive cryptographic key generation, such as prime generation and the indexing used in Universal Virtual One-Time Pad. Universal Virtual One-Time Pad (UVOTP) is an extended concept of the conventional One-Time Pad with the pad or a set of pads standardized and publicly known. A secret indexing is generated driven by some random input to pick pseudo-randomly from the pad for XORing the message into ciphertext. An example illustrates UVOTP here. Assume that 300 random input bytes or a stream of 2400 bits are accepted. First bits are reversed in order, then they are scrambled by some non-compressing hash function whose output is uniformly distributed. The scrambled bits B, still 300 bytes, are taken as one large number in binary representation and divided by 150 resulting in a remainder z. B is regrouped into 150 double-bytes d.sub.1, d.sub.2, . . . , d.sub.150. A sequence a.sub.1, a.sub.2, . . . , a.sub.8 within the inclusive range of [1,150] is then generated by R, a pseudo-random number generator, initialized by d.sub.z. Finally, 8 sequences are generated in the following manner: s.sub.1, s.sub.2, . . . by R.XI.2 with d.sub.y as the initialization seed where y=a.sub.1 p.sub.1, p.sub.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.2 n.sub.1, n.sub.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.3 x.sub.1, x.sub.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.4 b.sub.1.1., b.sub.1.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.5 b.sub.2.1, b.sub.2.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.6 b.sub.3.1, b.sub.3.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.7 b.sub.4.1, b.sub.4.2, . . . by R with d.sub.y as the initialization seed where y=a.sub.8 as well as 142 pairs of numbers (.alpha..sub.1 .beta..sub.1), (.alpha..sub.2, .beta..sub.2), . . . , (.alpha..sub.142, .beta..sub.142) driven by e.sub.1, e.sub.2, . . . , e,.sub.142 respectively, where 2.sup.8 -1<.alpha..sub.i <.beta..sub.i for 0<i<143 and the sequence e.sub.1, e.sub.2, . . . , e.sub.142 is the sequence d.sub.1, d.sub.2, . . . , d.sub.150 with the d.sub.y 's removed, where y=a.sub.1, a.sub.2, . . . , a.sub.8. The message is encrypted to ciphertext by XORing the ith byte of the message with a byte value defined by: (i*(.alpha..sub.j +p.sub.i).XI..beta..sub.j).XI.2.sup.8 if s.sub.i =0, and (i*(.alpha..sub.j +.sub.i).XI..beta..sub.j).XI.2.sup.8 otherwise where j=(b.sub.y,i .XI.142)+1 for .gamma.=x.sub.i .XI.4. Decryption is the same as encryption by XORing the bytes in the ciphertext. The basic concept can be implemented with many indexing schemes and the units for XORing can be any number of bits instead of the 8-bit byte shown in the previous illustration. In fact, the pad is `virtual` and if the number 2.sup.8 is replaced by 2.sup.c, the example is generalized to a virtual pad of c-bit units. To secure the data encrypted from partial exposure, this invention introduces two other methods: Backward-and-Forward Scrambling Method (BFS or BFSM) and Expanded Data Block Method (EDB or EDBM). The idea of BFSM is to scramble the data block in both directions in addition to performing encryption on it. Pairs of functions, scrambling functions F and B and their corresponding descrambling functions F.sup.-1 and B.sup.-1 are used where F.sup.-1 and B.sup.-1 have the property that for an input in the form a sequence of bits b.sub.1 b.sub.2. . . b.sub.n, in order to descramble b.sub.i for 1<i.ltoreq.b, m b.sub.j 's for j<i need to be descrambled first. In order to foil brute force attack, m should be large in general when m>i, and is recommended to be at least 128, Either backward scrambling or forward scrambling may be applied first. An example is the LZW compression function as F and the LZW decompression function as F.sup.-1, assuming the input is compressible. Another example is the use of DES where immediate previous bits are used as key to encrypt the following bits and there is an initial key, similar to the idea of initialization vector, for the first encryption of the input. Even though DES is used, the initial key is not required to be kept secret as the requirement for the processing is a scrambling function and not necessarily an encryption function. However, different initial keys are required for each scrambling operation if DES is used, or in a general sense, the scrambling operations elected should not cancel each other out. To apply backward scrambling, the input bit sequence can be first reversed, i.e. b.sub.1 b.sub.2. . . b.sub.n becoming b.sub.n b.sub.n-1. . . b.sub.1, and then scrambled, or the bit sequence can be first grouped into units of size suitable for the scrambling function and then the units order reversed before applying scrambling. After the scrambling processing, the bit sequence or unit sequence is again reversed. Descrambling reverses the input the same way. A generalization of BFSM is to use permutation and scrambling operations that enforce full block dependency instead of the more specific reverse operation. For example, if the input size in bits is m, then swapping bit i with bit m-i+1 for 0<i<129 can provide full block dependency with proper scrambling operations applied in the proper order in chaining mode. Since the larger the data block the less the effective success rate of attack-on-code cryptanalysis directly on ciphertext when the code level success rate of cryptanalysis is less than one, if it is guaranteed that the data block be of some suitably large size, the security of the encrypted block can be improved when BFSM is applied. To ensure a large enough block can be formed, the data block can be expanded by embedding redundant bits. For example, some expansion method similar to that defined for VLLM can be adopted, with enough bits, other than the true data bits, inserted/embedded to expand the block to the desired size. This technique is EDBM. Both BFSM and EDBM can be applied to QPKS and PPKS, but they are not limited to this invention. Any cryptographic method threatened by only partially successful attack-on-code can apply BFSM and EDBM to improve the security of the cryptosystem. Feedback mode (stream cipher feedback or block chaining), which is some type of scrambling in essence, can also be used at various levels. At code level, each code is used to scramble the next message unit, or each message unit is used to scramble the next code. The former is referred to as glued and the latter linked. This invention recommends the use of linked feedback. Code level feedback will stop at the boundary of blocks. At block level, the last message unit (or its code) of the previous block communicated is used to scramble the first code (or message unit) of the next block. At session level, feedback persists from session to session, e.g. utilizing session identifiers. Feedback is affected by the avalanche effect, which is change in bits of the succeeding codes (and thus the decodes) affected by the change of any single bit of the current code/decode. Avalanche effect has two parameters: length and width. Length refers to the number of succeeding codes/decodes affected and width refers to the number of bits in each of the succeeding codes/decodes affected. The larger the width, the more security provided. If the length is constant or is bounded by some maximum, it is called limited (avalanche) length. If the length is not bounded by any maximum, i.e. all succeeding codes/decodes are affected, it is called unlimited (avalanche) length. This invention can adopt both stream ciphers and block ciphers with any avalanche effects for feedback. An alternate form of applying BFSM is to make use of feedback mode. Since feedback is in essence a type of scrambling in a chaining fashion, it can be utilized as one of the bi-directional scrambling operations, e.g. data are first scrambled backward with one type of scrambling and the scrambled version is then encrypted in feedback mode. In still another embodiment, for each instance of encryption where the scrambling operations are not standardized but dynamically elected, the specification of the bi-directional scrambling can be appended at the end of the scrambled data, and sent encrypted in linked feedback mode. It should be obvious to anyone skilled in the art that, to enhance security, encryption may take the general form E(K(M).multidot.K) when it is not required that decryption of M must start before the entire E(K(M).multidot.K) is obtained, where K=H(M).multidot.r for some one-way hash function H and some random bits r. K(M) is some fast symmetric encryption by K as the key, and H(M) is H operating on a message M, but not necessarily on the entire M. A session identifier is a bit sequence of length zero or more that is communicated during a secure session. For example, if during a session a file is encrypted and sent from one party to another, then the parties can decide on any bits in the binary representation of the file to be the identifier for that session. There will be some maximum that controls the FIFO (first-in-first-out) queue of the session identifiers. When the maximum is reached, the oldest identifier is discarded and the new one is added to the end of the queue. Session identifiers can be used in various ways to enhance security. For example, the communicating parties can agree on a random salt for a session and use the compress hash on the concatenation of the session id's to produce a symmetric key to encrypt a lower layer. In formal identification, the session identifiers in their `raw` form or preferably in a processed/hashed form can be requested as part of the entire challenge. In particular, all identifiers can be requested in forming the reply to the challenge, or selected ones can be requested, or even subsequence of the bits of all or selected identifiers can be requested in either the `raw` form or preferably in a processed form as the reply to the challenge. Fuzzy residue in this invention is to greatly escalate the complexity of attack-on-code cryptanalysis. The various methods introduced in the following paragraphs include fuzzy residue indexing (mapping), removable and unremovable fuzziness, key element designation (for the indexing of fuzzy residues), reflexive dependency of message units, and the use of blurring sets. An example of fuzziness is a zero-one set {1, 2, 3, 7, 11}. Given a number 10, it can be the subset sum of 1, 2, and 7, or the subset sum of 3 and 7. Without more specific characteristics of the set, the fuzziness is unremovable, i.e. there is no way to tell which of the two combinations, 1-2-7 or 3-7, is the correct decode for the given number 10. If in addition there is the rule that either 3 or 7 but not both will have to be in any subset sum, the fuzziness is removable. In this particular example, 10 can only be decoded to 1-2-7 because the decode 3-7 will have violated the rule. There can be other types of removable fuzziness, e.g. sparse syntax and semantics of the original data can help remove much or most and likely all of the fuzziness. The key set can be designed and constructed in such a way that the designer/constructor can efficiently find out the correct decode in a removable fuzziness case or all possible decodes in an unremovable fuzziness case. The `amount` of fuzziness can also be controlled based on how the set is constructed. E.g. the set {1, 2, 3, 7, 11} is 25% fuzzy, i.e. out of 100 (arbitrary) subset sums, there will be 25 on average that can be decoded in more than one way. If the set is {1, 2, 5, 10, 18}, it is 3.125% fuzzy. If the set {1, 2, 3, 7, 11} is transformed to two sets: a zero-one set {1, 2, 7, 11} and a fuzzy residue set {0, 3}. The fuzziness is removable with the mapping (indexing) rule that the subset sum is added 0 if the data bit corresponding to 7 is 1, and is added 3 otherwise. Indexing and mapping of the fuzzy residues can take various forms. One straightforward way is to designate key elements to map to elements in the fuzzy residue set. As a simple example, the designation of a single key element is illustrated next. It is assumed that k of the n elements of the entire key set are generated, where k<n, and that the next element is the first in the set to be designated for fuzzy residue mapping. Let h=4, and generate a set of random numbers F={f.sub.1, f.sub.2, . . . , f.sub.16 }. The next element is generated the following way: a.sub.k+1 =sum(A)*(2.sup.h -1)+max(F)+R where R is the ranged random number generator that will produce some suitable number and A={a.sub.1, a.sub.2, . . . , a.sub.k } is the set containing all key set elements before a.sub.k+1 is generated. Fuzzy residues are applied in the following way: if x is the value of the bit group corresponding to a.sub.k+1, then f.sub.x+1 is added to the subset sum. As an example, it can be specified for one instance of encryption that if the bit group value of a designated element is 1, 3 times a certain fuzzy residue will be added; and if the value is 2, 5.5772 times the fuzzy residue with a limited precision will be added; if the value is 3, 0 time the fuzzy residue will be added, etc. Furthermore, a set of less than .sub.2 h residues can be added to the subset sum by some special pre-defined or agree upon mapping where such agreement is reached by a protocol carried out in shielded mode. For example, given a fuzzy residue set: {5, 6, -2, -1}, 5 is added to the subset sum if the corresponding bit group value is a multiple of 4; 6 is added if the value divided by 4 leaves a remainder 1, -2 is added if the value divided by 4 leaves a remainder 2; and -1 is added if the value divided by 4 leaves a remainder 3. The mapping and indexing described above make the decryption/cryptanalysis of a code depend on the contents/values of the decrypted/cryptanalized result of the code itself. Such a way of introducing (fuzzy) residues is the application of Reflexive Dependency. During decryption, when the designated element is `exposed`, its value will become known and will be used as index into F or in other designed methods to find the multiple of a corresponding fuzzy residue applied. Then with the fuzzy residue identified and removed, the decoding/decryption to obtain the rest bits of the message unit can proceed. Mapping can be numerous. The value of bits corresponding to a single key element can be individually mapped to a certain multiple of a fuzzy residue. The sum of the values of bits corresponding to more than one or even all the elements of a key section can also be used to map to some multiple of a fuzzy residue. Even a single element can be designated more than one fuzzy residue with different multiple mapping for the residues. In implementation, for example, a certain residue x that has been mapped by some element of one of the previously generated and iterated sections can also be mapped to by an element z of the key section currently being generated. In particular, if y is some number, then y-x can be a second residue for the currently generated key element where, if the mapping from z to x and y-x are the same, the residue is effectively just y. The values for fuzzy residues can take a wide range. Special mapping can be communicated first, possibly in shielded mode, before encryption starts. In applications, a key may be used for multiple messages without losing the message specific capability by making the residue mapping message specific. That is, even with the same key set and the same fuzzy residue set, each message can adopt a different fuzzy residue mapping, that is possibly communicated first in shielded mode, for the instance of secure communication. Residues can be designed to disturb any inherited regularity of the public key set as well as to introduce fuzziness. As an example, it is assumed that the application adopts PPKS and let k=1 and c be some non-zero integer. A unique set (of identifiables) is generated and iterated twice to result in A={a.sub.1, a.sub.2, . . . , a.sub.n }. Then a blurring set B={b.sub.1, b.sub.2, . . . , b.sub.n } is generated such that min(A)>max(B). To control the complexity of decryption, B can contain entries that are zeros and sum(B) can be limited to a number that is not too large. The public key vector is the permuted version of (a.sub.1 +b.sub.1 *c, a.sub.2 +b.sub.2 *c, . . . , a.sub.n +b.sub.1 *c), which in effect is equivalent to A+B' for B'={b.sub.1 *c, b.sub.2 *c, . . . , b.sub.n *c}. Encryption is still the simple inner product of the public key vector with the vector formed by bit groups. Decryption is more time consuming but parallel processing can speed up the calculations. As c and B are known, the `fuzziness` or the possible number of c's a subset sum (code) can contain is also known. For each possible multiple m of c, m*c is first subtracted from the subset sum (code), then the difference will go through the normal inverse iterations and decryption process. The result of each trial can be one of the following: 1) successful decode (i.e. the difference can be expressed as a subset sum) and m=D.times.B where D is the vector of decoded bit groups 2) successful decode (i.e. the difference can be expressed as a subset sum) but m< >D.times.B where D is the vector of decoded bit groups 3) failed to get a decode (i.e. the difference can not be expressed as any subset sum) In cases 2) and 3) it is known for sure that m, the number of c's subtracted, can not be right. Another valid multiple of c can be tried. In case 1), there can be two implications. One case is that the correct decode is obtained; the other case is one of internal fuzziness. It is obvious that of all possible multiples of c tried, if case 1) appeared only once, then the decode obtained is the correct decode. However, if case 1) occurred more than once, it is definitely internal fuzziness. Internal fuzziness, however, can be quite efficiently removed, as to be seen in the protocols later introduced. The concept of Rugged Compact Set is to leave `cracks` in the range of values for the multiples of an element in a compact (knapsack) set subset sum. In other words, certain values of the bit groups will never be used in forming the subset sums. For example, given n=2 and h=5, an initial compact set can be {1, 32}. Let x be some small number that is either pre-defined and publicly known or communicated (possibly in shielded mode) at the start of the session. For the convenience of the explanation of this example, let x be 3 and randomly select 3 numbers from the inclusive ranges of [0, 31] and also another 3 from the range of [32, 1023] and make them `cracks`. Then the radix, instead of 2.sup.h, will be 2.sup.h -3 and each number f | ||||||